palm

Bug bounty subdomain recon pre-filter for live and takeover checks.

subfinder -d example.com -silent | palm -status -title -server

palm is a bug bounty focused subdomain recon pre-filter. It sits after tools like subfinder, amass, assetfinder, findomain, or chaos and turns noisy discovery output into clean, live, actionable targets.

It reads subdomains from stdin or a .txt file, removes duplicates, normalizes messy tool output, checks DNS/HTTP liveness, adds lightweight context, and highlights possible subdomain takeover risks.

• Pipe-friendly: subfinder -d example.com -silent | palm
• File-friendly: palm subs.txt
• Built for post-discovery bug bounty triage
• Clean live target output for notes, reports, or the next tool
• Lightweight context: status, title, server, content length, response time
• Takeover fingerprint checks for quick risk prioritization
• Turkish and English help output
• Tiny Miami-mode easter egg hidden under the shade

palm is a focused triage step between subdomain discovery and deeper testing:

subdomain discovery -> palm -> manual review / deeper tooling

Use it when you want to quickly answer:

• Which discovered subdomains resolve?
• Which ones are HTTP/HTTPS live?
• Which live targets look worth opening first?
• Are there obvious takeover-risk fingerprints?

palm is not an httpx clone or a full web fingerprinting engine.

It intentionally does not try to be a screenshot tool, technology detector, WAF/CDN analyzer, favicon hasher, TLS deep inspector, path brute forcer, or headless browser. Those jobs belong to specialized tools. palm stays small so the bug bounty workflow stays fast.

Recommended Linux/macOS install:

curl -fsSL https://raw.githubusercontent.com/kaaangumus/palm/main/install.sh | sh

If you do not have curl:

wget -qO- https://raw.githubusercontent.com/kaaangumus/palm/main/install.sh | sh

The installer downloads the latest release binary and places it in /usr/local/bin, so you can run:

palm -version

Install without sudo:

curl -fsSL https://raw.githubusercontent.com/kaaangumus/palm/main/install.sh | PALM_INSTALL_DIR="$HOME/.local/bin" sh

Install with Go:

go install github.com/kaaangumus/palm@latest

If you install with Go, make sure your Go bin directory is in PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Build from source:

git clone https://github.com/kaaangumus/palm.git
cd palm
go build -o palm .

Build a Linux binary from another system:

GOOS=linux GOARCH=amd64 go build -o palm .

Release binaries are generated automatically when a v* tag is pushed.

Update later:

palm -update

Check whether a newer release exists:

palm -check-update

subfinder -d example.com -silent | palm -status -title -server -rt
subfinder -d example.com -silent | palm -takeover -status
subfinder -d example.com -silent | palm -mode dns -status -o resolved.txt
subfinder -d example.com -silent | palm -json -status -title -server -o live.jsonl

Default mode is http, so palm prints live https:// or http:// URLs.

Collect subdomains:

subfinder -d example.com -silent | tee subs.txt

Resolve and clean:

palm subs.txt -mode dns -status -o resolved.txt

Find live web targets:

palm subs.txt -status -title -server -rt -o live.txt

Check takeover-risk fingerprints:

palm subs.txt -takeover -json -o takeover-check.jsonl

Then manually review the interesting targets. Takeover matches are risk hints, not final proof.

Five common subdomain discovery tools:

subfinder -d example.com -silent | palm
assetfinder --subs-only example.com | palm
amass enum -passive -d example.com | palm
findomain -t example.com -q | palm
chaos -d example.com -silent | palm

Resolver output also works:

dnsx -l subs.txt -silent | palm -mode http -status

Show these examples from the CLI:

palm -tools

http   Try HTTPS first, then HTTP. Print live URLs.
dns    Resolve hosts. Print hosts that resolve.
both   Resolve first, then HTTP check. Print targets that pass both.

Match only selected HTTP status codes:

palm subs.txt -mc 200,301,302,403

Filter noisy status codes:

palm subs.txt -fc 404,500

Add lightweight HTTP metadata:

palm subs.txt -status -title -server -cl

Show response timing and redirect targets:

palm subs.txt -status -rt -location -follow-redirects=false

Send custom methods or headers:

palm subs.txt -method GET -H "User-Agent: palm-recon" -H "X-Recon: palm"

Use your own DNS resolvers:

palm subs.txt -mode dns -r resolvers.txt

Check subdomain takeover fingerprints:

palm subs.txt -takeover
palm subs.txt -takeover -json

-takeover checks CNAME targets and known provider error fingerprints. Treat matches as takeover risk findings that should be manually verified before reporting.

Only scan domains and infrastructure you own or have permission to test. palm is built for authorized recon workflows.

-l, -list string   subdomain list file
-o string          output file
-mode string       dns, http, both (default "http")
-r string          resolver file for DNS lookups
-c int             concurrent workers (default 100)
-timeout int       timeout in seconds (default 5)
-mc string         match HTTP status codes, comma-separated
-fc string         filter HTTP status codes, comma-separated
-json              write JSON lines
-status            include HTTP status or DNS IPs in text output
-title             include page title
-server            include server header
-cl                include content length
-rt                include response time
-location          include redirect Location header
-follow-redirects  follow HTTP redirects (default true)
-method string     HTTP method
-H string          custom HTTP header, repeatable
-takeover          check subdomain takeover fingerprints
-q                 only print live hosts/URLs
-tools             show common tool pipelines
-check-update      check latest GitHub release
-update            update palm with go install
-version           show version
-h                 show help

Parameter names stay in English. If your Linux locale is Turkish, palm -h shows Turkish explanations automatically.

Example:

LANG=tr_TR.UTF-8 palm -h

Plain live HTTP output:

https://api.example.com
https://app.example.com
http://dev.example.com

With status:

https://api.example.com [200]
https://app.example.com [302]

DNS mode with IPs:

api.example.com 104.20.23.154,172.66.147.243

JSON lines:

{"host":"api.example.com","live":true,"dns":true,"ips":["104.20.23.154"],"url":"https://api.example.com","status_code":200}

Somewhere under the palm tree:

palm -miami

Kaan Gümüş

See CONTRIBUTING.md.

See SECURITY.md.

MIT